Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable fs-verity asynchronously on package install

Browse Source 
Bug: 259179666
Test: atest ChecksumsTest
Test: atest CtsAppSecurityHostTestCases:android.appsecurity.cts.ApkVerityInstallTest
Change-Id: Ie87efba347bd2c9bf08928191b2c724a47abd18b
This commit is contained in:
Victor Hsieh
2022-11-17 13:54:46 -08:00
parent 4bdb6e5ef0
commit 2d8e9a3874
1 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
services/core/java/com/android/server/pm/InstallPackageHelper.java
View File

@@ -1845,15 +1845,30 @@ final class InstallPackageHelper {
continue;
}
VerityUtils.setUpFsverity(filePath, (byte[]) null);
// Verify fs-verity signature if exists.
final String signaturePath = entry.getValue();
if (new File(signaturePath).exists()) {
// If signature is provided, enable fs-verity first so that the file can be
// measured for signature check below.
VerityUtils.setUpFsverity(filePath, (byte[]) null);
if (!fis.verifyPkcs7DetachedSignature(signaturePath, filePath)) {
throw new PrepareFailure(PackageManager.INSTALL_FAILED_BAD_SIGNATURE,
"fs-verity signature does not verify against a known key");
}
} else {
// Without signature, we don't need to access the digest right away and can
// enable fs-verity in background (since this is a blocking call).
new Thread("fsverity-setup") {
@Override public void run() {
try {
VerityUtils.setUpFsverity(filePath, (byte[]) null);
} catch (IOException e) {
// There's nothing we can do if the setup failed. Since fs-verity is
// optional, just ignore the error for now.
Slog.e(TAG, "Failed to enable fs-verity to " + filePath);
}
}
}.start();
}
} catch (IOException e) {
throw new PrepareFailure(PackageManager.INSTALL_FAILED_BAD_SIGNATURE,